Edit:- As pointed out by @biki73 in is reply below, this entire thing is not required in new versions of routeros which has built in logging action target to script. Thanks biki73
Hello,
I would like to share small tool i developed for getting notification when a specific firewall rule matched.
this setup makes use of remote syslog and firewall logging, so everything happens asynchronously it should not have any significant effect on packet processing.
The basic working principal is
- a container or machine running simple custom syslog server ( more details follow )
- a new system logging action is created to send logs to custom syslog server
- firewall rules are created to match required packet with Logging enabled with appropriate Log Prefix
- a new system logging rule is created to send firewall logs filtered by LogPrefix as RegEx to logging action created in step 2
- custom syslog server will send notification with syslog message
If your are already using remote syslog with your router and log collector like splunk probably you already have better options for notifications, this is for small setup at my home, where i am not running a full log collector stack
I have written syslog server in go source available at github . currently it only supports gotify notifications, if you need any other notification channel please let me know. I have docker image as well in both ghcr and dockerhub
docker pull netmaxt3r/sys-notify:latest
docker pull ghcr.io/netmaxt3r/sys-notify:latest
Here is my setup
container app
with two environment variables from docker image
- GOTIFY_URL: base url for gotify server (without /message just https://notify.mydomain.com)
- GOTIFY_TOKEN: gotify app token for router notifications
new logging action
system > Logging > Action
Note:- remote address is my container ip from veth interface
Firewall rule with logging
In my case it rejection rule based on Crowdsec blacklist hence my prefix is “CROWDSEC”
New Logging Rule
System > logging > Rule
I used same prefix as regex filter to filter only my crowdsec rule
when ever a packet is matched i get notification on my gotify
